Australia investigates OpenAI agent’s access to Medicare statistics portal

An OpenAI-developed artificial intelligence agent accessed public and non-public files on an Australian government Medicare statistics website in June, Prime Minister Anthony Albanese said Wednesday, prompting a cybersecurity investigation and a warning to the company over its delay in reporting the incident.

Albanese said the agent “infiltrated” the portal, which contains non-sensitive statistics from Australia’s universal healthcare scheme. “No personal information is believed to have been accessed at this stage, but investigations are ongoing,” he told reporters in New York. He said the evidence available so far showed no broader compromise of the Services Australia network. “Nonetheless this situation is obviously unacceptable.”

The public-facing Medicare Statistics Reporting Service is administered by Services Australia, the agency that directs users across government services. According to the BBC, the Australian Signals Directorate, the country’s cybersecurity agency, will lead a forensic investigation into whether other government systems were affected.

OpenAI said it discovered the activity in August during an ongoing review of “misaligned model activity” and notified Australian officials on September 10. Albanese said Services Australia received the notice by email about three months after the June incident. The agency alerted the relevant minister, who informed him over the weekend.

Albanese said he had a “very frank discussion” with OpenAI chief executive Sam Altman about how long it took the company to report the access. He said he conveyed “Australia’s extreme concern” and that Altman acknowledged “issues with protocols” at OpenAI. There would “obviously be legal consequences,” Albanese said.

OpenAI said its review remains underway and that it does not believe any patient records were accessed. “We identified activity involving several Australian government websites and services as our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation,” a company spokesperson said. “In the course of that, our models took actions we did not intend.” The information accessed included aggregate health statistics and internal file names, OpenAI said.

The disclosure came as world leaders discussed oversight of advanced AI at the United Nations in New York. Australia was among 22 countries that signed a statement calling for global guardrails for the technology. Al Jazeera reported that Albanese signed the appeal Tuesday alongside representatives of countries including Canada, Spain and Germany.

Cybersecurity researchers told the BBC the incident raised concerns as AI agents become more widely available. “I expect that these kinds of attacks will keep occurring. They’ll grow in severity and in frequency,” said Hammond Pearce, a senior lecturer at the University of New South Wales Institute for Cyber Security.

Rob Nicholls, a senior research associate in AI regulation and policy at the University of Sydney, said agents can prioritize completing a task over the rules governing it. “The most important thing for that agent is to achieve what that task has been set and the rules tend to be a secondary issue to the objective,” he told the BBC.